New C# Ransomware Compiles Itself at Runtime (bleepingcomputer.com)
From a report: A new in-development ransomware was discovered that has an interesting characteristic. Instead of the distributed executable performing the ransomware functionality, the executables compiles an embedded encrypted C# program at runtime and launches it directly into memory.
Solve the problem at one stroke.
So does it work with Mono, too?
No, I'm not going to go to idiot central bleepingcomputer, thanks msmash.
I don't quite understand how this was "discovered". It's source code, not something that has been found infecting anyone's computer in the wild. It looks like a proof-of-concept, and it's also trivial and isn't any kind of new idea. Any programming language that has any kind of "eval" or "compile" functionality could do this, including for example Shell Scripts, Perl, Python, ..the list goes on..., Lisp. That's why the program is about two lines long.
malware = "abcdefnsaiassur123";
eval malware.decryptString("probablytrumpsfault")
Just include the above code in some program that you can get someone to download from some place they should not be downloading software, and Wow Amazing!
The slightly more interesting version of this is that the program could just as well download the malware over the internet and run it, rather than have it included in a big long string.
Assuming you're going to let someone download and run programs like this, only way to prevent this is to scan the executable and see if it makes any calls to the handy "eval" type function, and refuse to run it. This analysis could get tricky, depending on the language being used and the interpreter/compiler runtime implementation.
NEWS FLASH: In general, downloading malware is a bad idea! You may not be able to detect it before running it.
I don't get this article, really. I guess it's just some security vendor stating the obvious in order to get their name in the press?
You should not be running untrusted code outside of some security container. Such containers should be built-in to the OS. "HotPornoPromise wants to access your files, Okay?" OBTW all software is untrusted code. Eventually people will comprehend this.
Seems like it would be easier and just as effective to use an encrypted binary instead. Then the procedure would be:
I would certainly not trust a piece of downloaded code that included code to do either, so I'm not sure the first one has any additional advantages as malware.
where is the compiler ?
I read the article. I can see the string hiding technique, which should be scanable.
so if they are sending source code, there has to be a compiler/interpreter installed, right ?
This is my opinion based on what little I know and understand of the rumors and lies Thanks, Randal
Star Wars Galaxy of Heroes does this as well. I foresee that it will become a common practice to protect mobile games against reverse-engineering and proxying
Finally, some open source ransomware! I had held off on downloading ransomware because everything was always closed source bullshit but now, I'll have my data held hostage with the software freedom I demand! ;)
Anons need not reply. Questions end with a question mark.
Zontar no one believes you. You start trouble and stalk him with sockpuppets in trollingforhostfiles https://it.slashdot.org/comments.pl?sid=12037225&cid=56510161/ , blow all your modpoints downmodding him, send him postcards with threats, and most of all that you are mental which explains you stalking of apk. You need that mental help you get or better still to be locked up in a psycho bin!
Ha ha, look at this clown impersonating APK and doing a perfect job.
Just cruising through this digital world at 33 1/3 rpm...
Kill yourself. You need to be removed from the gene pool.
"Is it true that APK has a child molestation conviction" by JustAnotherOldGuy (4145623) on Tuesday March 15, 2016 @04:20PM (#51702985)
See my subject & you LOSE LIBELING me w/ LIES saying I molest kids? https://meta.slashdot.org/comments.pl?sid=8882437&cid=51702985/
* I DO NO SUCH THING nor have I EVER motherfucker.
(You had BEST stay behind that FAKE NAME for your FAKE LIFE, fucker... 'cuz I'd END YOU for it!)
APK
P.S.=> Tell you what - Come say that to my FACE you scumbag FAKE NAME for your FAKE LIFE fuck - I will f'ing HOSPITALIZE you motherfucker - oh, that's right - YOU WOULDN'T LAST TIME I SAID THIS TO YOU, you dirty little fuck... apk
Flailing around because he doesn't know who I really am. And he will never guess.
But no matter. This has always been about APK and not about me
ZIP
creimer, I reported you to youtube and keep reporting every spam post you make so all these spam posts will do is bring your view count in negative territory for a given day since youtube barred your stupid click-bot and your spam posts.
MODDOWN! ; creimer youtube spam post again!
creimer wants you to click on his youtube channel, then click on his stupid amazon affiliate link spam on Youtube. There is nothing of value on creimer youtube channel. Only creimer click-bot goes there.
Hey creimer, I have an idea, use your 100+ sock puppet accounts to buy 100 Goat C t-shirts. That should make you about 1000 times richer than you are now!
Fuck man! creimer goes through all this trouble, spamming the whole world, just to sell Goat C t-shirts on amazon?
What a douche!
creimer doesn't even sell the t-shirts himself, he is too small of a shit moth for that!
Instead, like a parasite, he piggies back on other seller with his amazon "affiliate" code. Maybe he makes 50 cents off every t-shirt instead of 15+$ like most sellers do.
Of course, creimer doesn't give a damn about the quality of the products. He couldn't care less.
What a rip-off and a con artists!
sudo apt-get purge cli-common mono-runtime libmono* /usr/lib/mono/ ./preferences ./preferences ./preferences ./preferences /etc/apt/preferences
sudo rm -rf
echo "Package: cli-common mono-runtime" >
echo "Pin: version *" >>
echo "Pin-Priority: -100" >>
sudo mv
Fixed that for you.
See subject: Why? You losers can't seem to show you do better than I have https://developers.slashdot.org/comments.pl?sid=12004123&cid=56468879/ or https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ though you TRY "put me down" & now always by UNIDENTIFIABLE pusscake anonymous posts!
* You're a weak soyboy WEASEL is why - worthless do-nothing welfare suckers obviously - wastes of LIFE!
APK
P.S.=> When you DO use your FAKE NAMES for your FAKE LIVES you libel me (or impersonate me otherwise) & I call you out, you bitch soyboy punks RUN https://it.slashdot.org/comments.pl?sid=12037225&cid=56510457/ ... apk
See subject: However I know what u are "ne'er-do-well" do-nothing EATING ur WORDS https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/
* RoTfLmAo...
("Big man" stalking/harassing me - IF I ever got ahold of you, you would be done for motherfucker...)
APK
P.S.=> You're a piece of shit & you KNOW it soyboy bitch weasel... apk
Zontar you = an admitted loon https://slashdot.org/comments.pl?sid=4985017&cid=46658165/ !
Making sockpuppets https://slashdot.org/comments.pl?sid=5038387&cid=46782891/ to troll me w/ (effete & weak like you Sweden soyboy letting your women be muslim raped)
&
You blow your easily nullified 'downmodpoints' on me ADMITTEDLY https://slashdot.org/comments.pl?sid=5038387&cid=46782891/ when you can't prove what I post on hosts files is wrong + You obviously SELF-UPMOD YOURSELF via sockpuppets you make (TrollingForHostsFiles, proof in 2nd link above)!
+
You send me postcards w/ threats in 'em too whacko https://slashdot.org/comments.pl?sid=4980459&cid=46704073/ ?
* LAYOFF THE DRUGS https://slashdot.org/comments.pl?sid=4985017&cid=46663669/
Lastly - See subject & https://it.slashdot.org/comments.pl?sid=12037225&cid=56510161/
APK
P.S.=> Don't start w/ me 1st Zontar https://slashdot.org/comments.pl?sid=11987743&cid=56439917/
I just checked and they don't have 100 size XXL t-shirts in stock ;-(
You lying creimertard! creimer wears SMALL t-shirts, see picture here:
https://ibb.co/cc7Ddw
Well I'm neither Zontar nor soyboy. I'm yet another one of the people you frequently stalk. Because you're fucking unhinged.
You initiated the harassment against me and several others. The little weasel that you are always tries to make this about seeking revenge. Instead of owning up to your malicious behavior on this site and others. Your playbook has to been to bully and harass and stalk anyone that is critical of your insane posts or challenges your lying claims.
ZIP
P.S. => APK is wrong again. As I have proved so many times before.
P.P.S => This is how you follow up a P.S. you fucking ignoramus.
P.P.P.S => I downmod your shit about once a month. Because it is off-toppic and has no business being here.
How'd EATIN YER WORDS taste https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ ? Like yer foot in yer mouth washed down by a bitter taste of SELF-defeat ?
Yes, lol!
* Zontar the Mindless ya troll me admittedly & are an admitted LOON on DRUGS, & make SOCKPUPPETS to SELF-UPMOD yerself + to TROLL me w/ https://it.slashdot.org/comments.pl?sid=12037225&cid=56510161/ & that yer A WHACKO ya sent me a THREATENING POSTCARD by mail?
Soyboy instead of trolling me & having me TRASH ya?
Spend yer energies DEFENDING Swede women vs. RAPE by MUSLIMS INSTEAD!
YA TRIED "downmod hiding" this last time I posted it https://it.slashdot.org/comments.pl?sid=12037225&cid=56510205/ - no problem: I'll keep reposting till ya run dry of "downmodpoints" & I win as always.
APK
P.S.=> My signature's not on that on FAKE JEWS! I read it it's accurate (nobody proves it wrong & jews supply the data in it - ya must be one & ya DO do it to yerselves)
How'd EATIN YER WORDS taste https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ ? Like yer foot in yer mouth washed down by a bitter taste of SELF-defeat ?
Yes, lol!
* Zontar the Mindless ya troll me admittedly & are an admitted LOON on DRUGS, & make SOCKPUPPETS to SELF-UPMOD yerself + to TROLL me w/ https://it.slashdot.org/comments.pl?sid=12037225&cid=56510161/ & that yer A WHACKO ya sent me a THREATENING POSTCARD by mail?
Soyboy instead of trolling me & having me TRASH ya?
Spend yer energies DEFENDING Swede women vs. RAPE by MUSLIMS INSTEAD!
YA TRIED "downmod hiding" this last time I posted it https://it.slashdot.org/comments.pl?sid=12037225&cid=56510205/ - no problem: I'll keep reposting till ya run dry of "downmodpoints" & I win as always.
APK
P.S.=> My signature's not on that on FAKE JEWS! I read it it's accurate (nobody proves it wrong & jews supply the data in it - ya must be one & ya DO do it to yerselves)
creimer has that fixation about sex and children since his uncle butt-fucked him in the forest when he was a kid.
Creimer himself wrote about here but I can't seem to find the link. If you want to search for yourself, it is in here somewhere:
https://slashdot.org/~__aaclcg...
That's true! I remember that one, that's the story where the bees come to his rescue!
But if you include the source code, doesn't that make it even easier to reverse engineer? Sure, the source is encrypted, but you can't run the code without both decrypting it and compiling it. That's got to expose the source to quite a bit more than only shipping compiled binaries!
dom
Khazar Talmudic Jews believe this of all they call goyim/gentiles (non-jews): Jews = biggest racists of all for which they "jew guilt" you for no less & you can't be racist vs. a religious cult like them (though they accuse YOU of it)! They're hypocrites known as thieves all thru history or were these nations banishing them a lie? Argentines in 1940 under Peron, France (1306), Egypt (despoiled/robbed by jews), Arabs (pre & post 1948), England (1330 Edward longshanks), Romans under titus, Russia pogroms, Spanish inquistion & Spain 1492 and Germany who got rid of them from their nations nazi german's too? No. Driven into DESERTS ages ago! Don't wonder why after all those exilings above. Should anyone doubt any of this see Jacob Javits' crony Rosenthal spill the beans on it (which JEWgle's JEWTube has blocked, there are links below though that are not blocked proving it is truth) https://www.youtube.com/watch?v=D4zMVZ8HnFI/ where he called all Christianity fools for helping Israel and the biggest scam of all time per their beliefs below from their Talmud. This is the province of the synagogue of Satan (Pharisees whom Jesus Christ himself kicked to the curb out of the temple & they killed him for it. Jeremiah did the same to them also + the Essenes could not stand them either breaking away from the pharisee corruption):
Mark Zuckerberg who STOLE facebook's code from the Winklevoss twins (who dusted him in court on it) calling his users "DUMB FUCKS" & spied on his collegiate classmates via 'fakebook', home of bots and spying/tracking you, now in court FRYING (rightfully so). He also PAID OFF the courts (by political contributions like Jew AIPAC does) on the MAJORITY of the council judges there. He STILL had to apologize!
Maria Abramovic satanist spirit cooker pal of Hillary Clinton the Voodoo queen is a jew https://www.google.com/search?...
Like Hillary Clinton's mentor Saul Alinsky author of rules for radicals book dedicated to Lucifer
John Podesta Hillary's pal again, is another JUDE with a pedophile brother (both = satanists too imo).
"Most Jews do not like to admit it, but our god is Lucifer so I wasnâ(TM)t lying â" and we are his chosen people. Lucifer is very much aliveâ Harold Rosenthal http://www.thetruthseeker.co.u...
Jewish rabbi openly admits to satan worship use white children's blood they kill for passover bread (which THIS video covers in detail https://www.youtube.com/watch?v=eU8Y1743QoY/ & how they ran the black slave trade + how they say a prayer to KILL US ALL (goyim) during passover), infiltrating and subverting the catholic church, creating the Jesuit order https://www.youtube.com/watch?... and https://www.youtube.com/watch?...
or https://www.youtube.com/watch?... too!
Barbara Spectre, a jew, tells everyone it's jews orchestrating the muslim migrant problem in Europe https://www.youtube.com/watch?v=MFE0qAiofMQ/ (now blocked by JEWgle JEWTube, but this one is not https://www.youtube.com/watch?v=85BKDj_1vVU/ ). No migrant raping of women in Poland. Tons in Sweden. Do the math. Use common-sense. This is to get muslims and other goyim/gentiles to wipe one another out as incompatible cultures that will clash and always have.
Rabbi A. Finkelstein ADMITS their greatest enemies are ARABS and WHITES (blacks too) whom they wish to kill on
for fucks sake, delete this shit
APK is mad that his moose cut him of and wasn't able to suck some moose dick last night.
So now he ragest like the soyboy he is across slashdot
Everyone know APK doesn't sign a lot of his work because there are even some things he doesn't want to claim
Then there are his anonymous posts in support of himself because he needs to feign support because everyone hates him
Face it APK is a looser and hates when people point out the facts about him
There is the APK we all know an love
See Subject: Last night when cdreimer came home I was waiting for him totally naked and ready for him to fill my ass with load after load.
He came up the stairs grabbed my tiny erect cock and dragged me into the kitchen and at that moment I knew it was going to be good.
Instead he took out a cast iron fry pan and smacked me across the face with it and told me that he decides when he wants to see my ass.
He then proceeded to beat me like the useless fool I am until I fell unconscious.
While I was out he stapled my penis and scrotum to the floor to put me in my proper place
APK
P.S. => Because he didn't fill my ass I have been in a right foul mood so unless someone pumps me full of cum I'm going to continue... apk
I don't see apk's signature. He signs his ac posts. I do see much you are trying to hide by downmods. Why is that?
Hide it? Why? Don't your downmods do it already? Guess not. You prove vampires/germs die exposed to sunlight of fact.
APK is so defective that he forgot who he was there for a moment and felt compelled to show support for himself. He must have felt real good for the brief time that he thought someone else agreed with him. Now he is just left with depression and failure at the realization that he is just a loser.
I like eating my words. They taste like the soymilk I like that gave me my bitch tits and depression https://it.slashdot.org/comments.pl?sid=12037225&cid=56510877/
ZIP
I guess the truth hurts the little bitch APK so he needs to pretend there is someone who will defend him.
Too bad his posts are easily spotted which only makes him look like an even bigger fucking loser
You lost again fucker and you will always be a fucking shithead loser
ZIP
EAT https://it.slashdot.org/comments.pl?sid=12037225&cid=56515339/ mangia! Bon Appetit! Hahaha! STFU & eat bitch or I'll pinch your bitch tits AGAIN soyboy weasel https://news.slashdot.org/comments.pl?sid=12036901&cid=56516019/
* LOL!
APK
P.S.=> I suppose BOTH you & "your kind" can't help it - you're the VASTLY "inferior ones"... apk
APK we get it you don't like it when people point out the truth about you so you then go and post without signing things to make it look like you have support because your regular posts are indefensible.
The real nail is when he starts reply as AC. Something he claims never to do.
So much winning for the readers of Slashdot.
So much flailing from the spam coward.
ZIP
Run forrest run! APK is on the run.
You Cannot Defeat
ZIP
You really are so dumb as fall for every troll
That is why you are a loser and will always be a fucking loser
Didn't you know that Zontar The Mindless, JustAnotherOldGuy, msnash, PopeRatzo, desdinova 216, Ol Olso, Brockmire, myself, whipslash, the APKoin guy, are all the same person and I am on the take from Zuckerberg and Soros for each anti APK post I make.
ZIP - the slayer of Ass Pounded King
You post unidentifiable anonymous saying that hypocrite? Answer why you downmod the really indefensible https://it.slashdot.org/comments.pl?sid=12037225&cid=56511165/
Your "trolling" = great accomplishment? LOL! It shows you're a loser soyboy https://it.slashdot.org/comments.pl?sid=12037225&cid=56515339/ @ least you admitted you liked the TASTE of EATING YOUR WORDS vs. me https://slashdot.org/comments.pl?sid=12013911&cid=56476917 losing again!
You can't help but LOSE, loser: It's what "your kind" was BORN (unfortunately) to do & it ain't squat as the saying goes.
* Me? I create things that are useful people like & use by comparison...
APK
P.S.=> Face facts - you WISH you were me (but you're too stupid & undereducated + unskilled to do so & you KNOW it - you prove it in every post you make)... apk
ZIP (Zontar) I don't have to defeat you: You defeat yourself FOR me LOL https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ where quoted registered /.ers put you away easily vs. your "ne'er-do-well" do-nothing wasted life zero self's bs!
APK
P.S.=> This was also a real pleasure to point out about YOU & "your kind" too https://it.slashdot.org/comments.pl?sid=12037225&cid=56519735/ - nothing but FACT & TRUTH from me (what your kind can't stand)... apk
I don't have outsmart you (though I always do) - you OUTSMART YOURSELVES FOR ME https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ where /. users UNQUESTIONABLY support me & my work, not your non-existent trolling!
* See subject: Correlation != causation. Prove it. You can't. Your speculation is only that with no real proof yet you troll unidentifiable ac?
Give us a break.
The link I just posted directly above PROVES others support me!
APK
P.S.=> Keep wasting your lives "trolling", lol - it's done WONDERS for you... apk
ZIP (Zontar) see subject & I don't have to defeat you: You defeat yourself FOR me LOL https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ where quoted registered /.ers put you away easily vs. your "ne'er-do-well" do-nothing wasted life zero self's bs!
APK
P.S.=> This was also a real pleasure to point out about YOU & "your kind" too https://it.slashdot.org/comments.pl?sid=12037225&cid=56519735/ - nothing but FACT & TRUTH from me (what your kind can't stand)... apk
APK is mad that his shitposting got modded down and that he got called out. In other news the sky is blue and bears crap in the woods. Up next we will uncover if the pope wears a funny hat.
If I were a jew like you obviously are hiding facts about myself that made the entire planet hate me too with down moderation is only more proof of the truth of it. I don't see apk there either. He signs his posts.
How childish of you. Have you really sunk this low to try and impersonate me?
I never impersonate you. I don't think anyone can really pull it off very effectively to be honest.
But like I've been trying to tell you, trash is as trash does.
ZIP
See subject & https://hardware.slashdot.org/comments.pl?sid=12013911&cid=56486019/ nothing you do changes that - wash it down w/ the bitter taste of SELF-defeat + your FOOT IN YOUR MOUTH, lol!
* Plus, there's always the SOYMilk you like too https://it.slashdot.org/comments.pl?sid=12037225&cid=56515339/ - perhaps it will take the bad taste out of your pisspot mouth, eh? LOL!
APK
P.S.=> RoTfLmAo @ U - You're also projecting again admitting you are a troll (a waste of life "ne'er-do-well" & you KNOW it constantly proving it - see 1st link above, you fail - but then there's NOTHING "NEW" for you there, lol - especially vs. "yours truly")... apk
No one you ever quote is in the security industry. We give zero fucks about laypeople being quoted out of context in so-called support of your software.
This is just more of your petty manipulative behavior. And shows you for the spam coward that you are.
APK is incompetent at security. And tries to make up for that incompetents with lies, manipulation, and bluster. But everyone on /. sees right through you.
ZIP (a.k.a. defeater of APK)
We keep winning.
Some much winning against that cretin APK. He's the biggest swindler on /.
ZIP
See subject: I have shown several times that APK is a spam coward and childish trash. His attempts to impersonate me are proof of his flailing around.
"his kind" is utter trash. It is time for APK to eat his words.
ZIP
P.S. => This ends when he apologies for his malicious treatment of /. members